registry / @object-ui/app-shell / 11.4.0

@object-ui/app-shell@11.4.0

Minimal application shell for ObjectUI - framework-agnostic rendering engine

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 326 file(s), 2.98 MB of source, external domains: api.example.com, cloud.objectos.app, docs.objectstack.ai, example.com, www.w3.org

Source & flagged code

1 flagged

dist/views/metadata-admin/JsonSourceEditor.jsView file

Lines 7-47javascript

7 * LICENSE file in the root directory of this source tree.

8 */

9/**

10 * JsonSourceEditor — Monaco-backed JSON editor for the metadata

11 * designer's "Source" tab. Replaces the old textarea so power users

12 * get syntax highlighting, bracket matching, folding, and inline

13 * error squigglies driven by the server-side `_diagnostics` payload.

14 *

15 * Markers: `issues[]` use dotted (or array) JSON paths matching the

16 * Zod issue shape. We resolve each path to a Monaco range with

17 * `jsonc-parser` so the squiggle lands on the offending value (or

18 * the property key when the value is absent). Unresolved paths fall

19 * back to a marker on line 1, so nothing is silently lost.

20 */

21import React from 'react';

22import { Skeleton } from '@object-ui/components';

23import * as jsonc from 'jsonc-parser';

24import { detectLocale, t } from './i18n';

25// Lazy: Monaco's React wrapper itself pulls in the editor core

26// (~3MB), so we keep it out of the initial app-shell chunk.

27const LazyMonaco = React.lazy(async () => {

28 const mod = await import('@monaco-editor/react');

29 return { default: mod.default };

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/views/metadata-admin/JsonSourceEditor.jsView on unpkg · L27

30});

31function stringify(v) {

32 try {

33 return JSON.stringify(v ?? {}, null, 2);

34 }

35 catch {

36 return '{}';

37 }

38}

39/** Parse a dotted JSON path like `fields.owner.0.type` to segments. */

40function splitPath(p) {

41 if (!p)

42 return [];

43 return p.split('.').map((seg) => {

44 const n = Number(seg);

45 return Number.isInteger(n) && String(n) === seg ? n : seg;

46 });

47}

Source & flagged code

1 flagged · loading source

dist/views/metadata-admin/JsonSourceEditor.jsView file

27package = @object-ui/app-shell; repositoryIdentity = objectui; dependency = @monaco-editor/react L27: const LazyMonaco = React.lazy(async () => { L28: const mod = await import('@monaco-editor/react'); L29: return { default: mod.default };

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/views/metadata-admin/JsonSourceEditor.jsView on unpkg · L27

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/views/metadata-admin/JsonSourceEditor.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/views/metadata-admin/JsonSourceEditor.jsView file

Lines 7-47javascript

7 * LICENSE file in the root directory of this source tree.

8 */

9/**

10 * JsonSourceEditor — Monaco-backed JSON editor for the metadata

11 * designer's "Source" tab. Replaces the old textarea so power users

12 * get syntax highlighting, bracket matching, folding, and inline

13 * error squigglies driven by the server-side `_diagnostics` payload.

14 *

15 * Markers: `issues[]` use dotted (or array) JSON paths matching the

16 * Zod issue shape. We resolve each path to a Monaco range with

17 * `jsonc-parser` so the squiggle lands on the offending value (or

18 * the property key when the value is absent). Unresolved paths fall

19 * back to a marker on line 1, so nothing is silently lost.

20 */

21import React from 'react';

22import { Skeleton } from '@object-ui/components';

23import * as jsonc from 'jsonc-parser';

24import { detectLocale, t } from './i18n';

25// Lazy: Monaco's React wrapper itself pulls in the editor core

26// (~3MB), so we keep it out of the initial app-shell chunk.

27const LazyMonaco = React.lazy(async () => {

28 const mod = await import('@monaco-editor/react');

29 return { default: mod.default };

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/views/metadata-admin/JsonSourceEditor.jsView on unpkg · L27

30});

31function stringify(v) {

32 try {

33 return JSON.stringify(v ?? {}, null, 2);

34 }

35 catch {

36 return '{}';

37 }

38}

39/** Parse a dotted JSON path like `fields.owner.0.type` to segments. */

40function splitPath(p) {

41 if (!p)

42 return [];

43 return p.split('.').map((seg) => {

44 const n = Number(seg);

45 return Number.isInteger(n) && String(n) === seg ? n : seg;

46 });

47}